Security

Bank-statement data is sensitive, and BankStmt is built accordingly. This page describes the security measures actually in place. It describes practices, not certifications — where we hold no independent certification, we say so rather than imply one.

Encryption

• All traffic is encrypted in transit with TLS.
• Data is encrypted at rest in managed storage and databases.
• Sensitive fields receive additional application-level encryption (AES-256-GCM) with keys held in a managed secret store, never in source code or configuration files.

Tenant isolation

Every record is bound to a tenant, and tenant scoping is enforced in the application and query layers on every read and write — including through the public API, where an API key resolves strictly to its own tenant. Cross-tenant access is not possible through the product surface.

Access control

• Authentication is delegated to a dedicated identity provider using standard OpenID Connect with PKCE.
• Plan entitlements and premium features are enforced server-side, not merely hidden in the interface.
• Internal access to production follows least privilege, is limited to what is needed to operate the Service, and is logged.
• API keys are stored only as hashes; the secret is displayed once at creation and cannot be retrieved afterwards. Keys can be scoped read-only, given an expiry, and revoked instantly.

Monitoring, logging and resilience

• Significant actions are recorded in an audit log.
• Rate limiting and abuse protection guard both the application and the public API.
• Databases are backed up regularly, with restores exercised; backups are encrypted.
• Dependencies are patched on an ongoing basis and errors are monitored to catch faults early.

Your data, your control

You can export your data at any time in open formats, delete individual statements, or delete your account entirely — which removes your content, subject only to legally required retention and the backup overwrite cycle described in the Privacy Policy.

Certifications

BankStmt does not currently hold SOC 2, ISO 27001 or PCI DSS certification, and does not claim to. Card payments are handled entirely by our PCI-DSS-compliant payment processor, so card data never reaches our systems. If you require a specific certification or a completed security questionnaire, contact us via https://bankstmt.com/contact.html?topic=security to discuss.

Reporting a vulnerability

Report security issues via https://bankstmt.com/contact.html?topic=security. We aim to acknowledge within 2 business days and to keep you updated until resolution. Please follow the responsible-research conditions in the Acceptable Use Policy.

Contact

Questions about these documents or your data? Use our contact form: https://bankstmt.com/contact.html?topic=privacy . For security matters: https://bankstmt.com/contact.html?topic=security .